PLC equipment identification method and system, storage medium and terminal

Abstract

The invention provides a PLC equipment identification method and system, a storage medium and a terminal. The method comprises the following steps: acquiring an IP address and a physical address of PLC equipment in a network; obtaining the manufacturer type of the PLC equipment based on the physical address of the PLC equipment; identifying a characteristic port of the PLC equipment based on the manufacturer type; and when the characteristic port can be connected, acquiring basic information of the PLC equipment based on an industrial Ethernet protocol message corresponding to the manufacturer type. According to the PLC equipment identification method and system, the storage medium and the terminal, accurate identification of the PLC equipment can be realized through the industrial Ethernet protocol message, and the compatibility is high.

Description

Technical Field

[0001] The present invention relates to the technical field of programmable logic controller (PLC), and in particular to a PLC device identification method, system, storage medium and terminal. Background Art

[0002] PLC is an electronic system that operates digital operations and is designed for use in industrial environments. It is widely used in the field of industrial control. For professional network management software focusing on the industrial field, it is necessary to manage various important devices in the network, including PLC devices. Therefore, the management of PLC devices has important practical significance.

[0003] The first step in managing PLC devices is to identify and obtain basic information about them. In the prior art, general network management software can only manage PLC devices as ordinary IP nodes because they have IP addresses, and monitoring is limited to a few indicators of the Internet Control Message Protocol (ICMP).

[0004] At present, the industrial Ethernet communication protocols used by PLC devices basically include the following:

[0005] (1) Open protocols independently developed by manufacturers

[0006] For example, MODBUS protocol, ETHERNET / IP protocol, PROFINET protocol. MODBUS protocol is a protocol developed by Modicon for PLC communication. ETHERNET / IP protocol was designed by a working group of ControlNet International and ODVA (Open DeviceNet Vendor Association) in the 1990s. EtherNet / IP is based on Common Industrial Protocol (CIP) and is a standardized open protocol. PROFINET is also an open protocol, but specific hardware is often required in practical applications.

[0007] (2) The manufacturer develops a proprietary protocol and does not provide protocol details

[0008] For example, Siemens' S7 protocol is private and has no public documentation to describe its message format. The analysis of this protocol on the Internet is based on reverse engineering such as message parsing.

[0009] (3) The manufacturer develops a private protocol and provides protocol details

[0010] For example, Omron's FINS protocol, Mitsubishi Electric's MELSEC protocol, etc. These protocols provide documentation on communication sessions and protocol message formats.

[0011] (4) Standard Protocol

[0012] For example, Inovance PLC supports both ModbusTCP and ETHERNET / IP protocols.

[0013] Therefore, it can be seen from the above that the PLC devices in the prior art do not have a unified communication protocol, which hinders the further management of the PLC devices by ordinary network management software. Summary of the invention

[0014] In view of the above-mentioned shortcomings of the prior art, the purpose of the present invention is to provide a PLC device identification method, system, storage medium and terminal, which can accurately identify PLC devices through industrial Ethernet protocol messages and have strong compatibility.

[0015] In a first aspect, the present invention provides a PLC device identification method, the method comprising the following steps: obtaining the IP address and physical address of the PLC device in the network; obtaining the manufacturer type of the PLC device based on the physical address of the PLC device; identifying the characteristic port of the PLC device based on the manufacturer type; when the characteristic port is connectable, obtaining the basic information of the PLC device based on the industrial Ethernet protocol message corresponding to the manufacturer type.

[0016] In an implementation of the first aspect, the IP address and physical address of the PLC device in the network are obtained in any of the following ways:

[0017] Scan the subnet of the network based on the nmap tool to obtain the IP address of the PLC device, and obtain the corresponding physical address based on the IP address;

[0018] An ipNetToMedia table on the switch is obtained, a deduplication operation is performed on the ipNetToMedia table, and an IP address and a physical address of the PLC device are obtained based on the deduplication-free ipNetToMedia table.

[0019] In an implementation of the first aspect, acquiring the manufacturer type of the PLC device based on the physical address of the PLC device includes the following steps:

[0020] Construct an association table between the manufacturer type and physical address of PLC equipment;

[0021] The manufacturer type corresponding to the physical address of the PLC device is obtained based on the association table.

[0022] In an implementation of the first aspect, identifying the characteristic port of the PLC device based on the manufacturer type includes the following steps:

[0023] Construct an association table between manufacturer type and feature port;

[0024] A feature port corresponding to the manufacturer type is obtained based on the association table, and it is checked whether the feature port is open and connectable.

[0025] In an implementation of the first aspect, obtaining basic information of the PLC device based on the industrial Ethernet protocol message corresponding to the manufacturer type includes the following steps:

[0026] Obtain the industrial Ethernet protocol corresponding to the manufacturer type;

[0027] Establishing a connection with the PLC device based on the industrial Ethernet protocol;

[0028] Basic information of the PLC device is obtained based on the connection.

[0029] In an implementation of the first aspect, acquiring basic information of the PLC device based on the connection includes the following steps:

[0030] When the industrial Ethernet protocol is the S7 protocol, reading the device identification and CPU information of the PLC device;

[0031] When the industrial Ethernet protocol is the FINS protocol, read the device model, device version and CPU running status of the PLC device;

[0032] When the industrial Ethernet protocol is the MODBUS protocol, reading the device identification of the PLC device;

[0033] When the industrial Ethernet protocol is the EtherNet / IP protocol, the device name, device version and device serial number are obtained according to the response information of the PLC device.

[0034] In an implementation manner of the first aspect, the method further includes establishing a connection with the PLC device based on the SNMP / HTTP protocol when the PLC device supports the SNMP / HTTP protocol, and acquiring basic information of the PLC device.

[0035] In a second aspect, the present invention provides a PLC device identification system, the system comprising a first acquisition module, a second acquisition module, an identification module and a third acquisition module;

[0036] The first acquisition module is used to obtain the IP address and physical address of the PLC device in the network;

[0037] The second acquisition module is used to acquire the manufacturer type of the PLC device based on the physical address of the PLC device;

[0038] The identification module is used to identify the characteristic port of the PLC device based on the manufacturer type;

[0039] The third acquisition module is used to acquire basic information of the PLC device based on the industrial Ethernet protocol message corresponding to the manufacturer type when the characteristic port is connectable.

[0040] In a third aspect, the present invention provides a storage medium having a computer program stored thereon, which implements the above-mentioned PLC device identification method when executed by a processor.

[0041] In a fourth aspect, the present invention provides a PLC device identification terminal, comprising: a processor and a memory;

[0042] The memory is used to store computer programs;

[0043] The processor is used to execute the computer program stored in the memory, so that the PLC device identification terminal executes the above-mentioned PLC device identification method.

[0044] As described above, the PLC device identification method, system, storage medium and terminal of the present invention have the following beneficial effects:

[0045] (1) Ability to accurately identify PLC devices through industrial Ethernet protocol messages;

[0046] (2) Compatible with multiple industrial Ethernet protocols and highly practical. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 Shown is a flow chart of a PLC device identification method in one embodiment of the present invention;

[0048] Figure 2 Shown is a schematic diagram of obtaining basic information of a PLC device in an embodiment of the present invention;

[0049] Figure 3 Shown is a schematic diagram of the structure of a PLC device identification system in one embodiment of the present invention;

[0050] Figure 4 Shown is a schematic structural diagram of a PLC device identification terminal in one embodiment of the present invention. DETAILED DESCRIPTION

[0051] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0052] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0053] The PLC device identification method, system, storage medium and terminal of the present invention can realize accurate identification of PLC devices through industrial Ethernet protocol messages, and are compatible with multiple industrial Ethernet protocols to meet the needs of different application scenarios, thus being extremely practical.

[0054] like Figure 1 As shown, in one embodiment, the PLC device identification method of the present invention includes steps S1 to S4.

[0055] Step S1, obtain the IP address and physical address (Physical Address) of the PLC device in the network.

[0056] Specifically, the identification of the PLC device in the network is based on its corresponding IP address. In the present invention, the IP address and physical address of the PLC device in the network are obtained in any of the following ways:

[0057] 1) Scan the subnet of the network based on the nmap tool to obtain the IP address of the PLC device, and obtain the corresponding physical address based on the IP address.

[0058] It should be noted that if the network management machine does not belong to the scanned network segment, the physical address corresponding to the IP address is often not obtained.

[0059] 2) Obtain an ipNetToMedia table on the switch, perform a deduplication operation on the ipNetToMedia table, and obtain the IP address and physical address of the PLC device based on the deduplication ipNetToMedia table.

[0060] Step S2: Acquire the manufacturer type of the PLC device based on the physical address of the PLC device.

[0061] Specifically, the physical address is also called the MAC address (Media Access Control Address), which is an address used to confirm the location of a network device, similar to a house number. The physical address consists of six bytes, the first three bytes of which are obtained by the manufacturer from the IEEE, and the last three bytes are allocated by the manufacturer. For PLC devices, the physical address of the network card is fixed when it leaves the factory. Therefore, the manufacturer to which the physical address of the network card belongs can be determined by the first three bytes (prefix) of the physical address.

[0062] In one embodiment, obtaining the manufacturer type of the PLC device based on the physical address of the PLC device includes the following steps:

[0063] 21) Construct an association table between the manufacturer type and physical address of the PLC device.

[0064] First, different manufacturer types of PLC devices are associated with corresponding physical addresses to generate an association table, thereby reducing memory consumption and improving query speed. For example, in the association table, the first three bytes of the physical address are associated with the manufacturer type.

[0065] When constructing the association table, the manufacturer types of the same manufacturer are unified. This is because a manufacturer can apply for multiple physical address prefixes, but the manufacturer types may be inconsistent. For example, the manufacturer types for which Siemens applied for physical address prefixes include:

[0066] Siemens AG

[0067] SIEMENS AG,Digital Factory,Motion Control System

[0068] Siemens Numerical Control Ltd.,Nanjing,

[0069] Siemens Industrial Automation Products Ltd.,Chengdu

[0070] Others such as Siemens Healthineers and Siemens Energy can be excluded. For the above manufacturers related to PLC equipment, the manufacturer type is unified as Siemens.

[0071] 22) Obtaining the manufacturer type corresponding to the physical address of the PLC device based on the association table.

[0072] Wherein, the corresponding manufacturer type is searched in the association table according to the first three bytes of the physical address.

[0073] Step S3: Identify the characteristic port of the PLC device based on the manufacturer type.

[0074] Specifically, the Ethernet protocols used by the PLC device identification in the present invention all belong to the 5th to 7th layers of the OSI model and have their own default ports. It is necessary to check whether the port corresponding to the IP address is open and connectable.

[0075] In actual use, the characteristic ports of PLC devices are associated with the manufacturer type, as shown in Table 1.

[0076] Table 1. Correlation between characteristic ports of PLC devices, manufacturer types and industrial Ethernet protocols

[0077] No. Industrial Ethernet Protocol Feature Port Manufacturer Type 1 MODBUS 502 Modicon, acquired by Schneider Electric 2 EtherNet / IP 44818 Rockwell Automation 3 S7 102 Siemens communication protocol 4 FINS 9600 Omron Corporation

[0078] It should be noted that when the manufacturer type is unclear, each port needs to be tested one by one to identify the characteristic port.

[0079] In one embodiment, identifying the characteristic port of the PLC device based on the manufacturer type includes the following steps:

[0080] 31) Construct an association table between manufacturer type and feature port.

[0081] Among them, the manufacturer type of the PLC device is first associated with the corresponding characteristic port to generate an association table, thereby reducing memory consumption and improving query speed.

[0082] 32) Based on the association table, obtain the feature port corresponding to the manufacturer type, and check whether the feature port is open and connectable.

[0083] Wherein, the corresponding characteristic port is searched in the association table according to the manufacturer type.

[0084] Step S4: When the characteristic port is connectable, basic information of the PLC device is obtained based on the industrial Ethernet protocol message corresponding to the manufacturer type.

[0085] Specifically, Figure 2 As shown, obtaining the basic information of the PLC device based on the industrial Ethernet protocol message corresponding to the manufacturer type includes the following steps:

[0086] 41) Obtain the industrial Ethernet protocol corresponding to the manufacturer type.

[0087] Among them, the industrial Ethernet protocol corresponding to the manufacturer type is obtained according to the above Table 1.

[0088] 42) Establishing a connection with the PLC device based on the industrial Ethernet protocol.

[0089] 43) Obtain basic information of the PLC device based on the connection.

[0090] Wherein, when the industrial Ethernet protocol is the S7 protocol, the device identification and CPU information of the PLC device are read.

[0091] Specifically, there are multiple versions of Siemens PLC protocol, which can be mainly divided into:

[0092] (1)S7Comm

[0093] The S7-200, S7-300, and S7-400 series PLCs use the early Siemens proprietary protocol S7comm for communication. This protocol does not have the encryption function of S7Comm-Plus and does not involve any anti-replay attack mechanism, which can be easily exploited by attackers.

[0094] (2) Early S7CommPlus protocol

[0095] The communication protocol before S7-1200 series v3.0 adopts the early S7Comm-Plus protocol.

[0096] (3) The latest S7CommPlus protocol

[0097] The S7-1200 series v4.0 and S7-1500 series use the latest S7Comm-Plus protocol. The latest S7Comm-Plus protocol introduces session ID to prevent replay attacks and encrypts key traffic.

[0098] When establishing a connection with the characteristic port 102 of the PLC device, a session is created and communication parameters are initialized. Next, the specified SZL (system status list) information is read to describe the current status of the PLC device. The content of the system status list can only be read and cannot be modified. Among them, data such as module identification and CPU information can be read. Then, LLDP (Link Layer Discovery Protocol) messages can also be sent to the PLC device. By capturing LLDP messages, the LLDP messages of the specified network card on the network management machine can be checked regularly.

[0099] When the industrial Ethernet protocol is the FINS (Factory Interface Network Service) protocol, the device model, device version and CPU running status of the PLC device are read. Specifically, when the feature port 9600 is connected, the model and version of the PLC device can be obtained by sending the command 0x0501; the status (running / stopping) of the PLC device CPU can be obtained by sending the command 0x0601.

[0100] When the industrial Ethernet protocol is the MODBUS protocol, the device identification of the PLC device is read. When the specific port 502 is connected, the device identification of the PLC device is read according to the MODBUS protocol. The device identification includes multiple object contents, among which the supplier name, product code, major and minor version numbers are mandatory, and the supplier URL, product name, model name, and application name are optional.

[0101] When the industrial Ethernet protocol is the EtherNet / IP protocol, the device name, device version and device serial number are obtained according to the response information of the PLC device. When the feature port 44818 is connected, a ListIdentity command is sent to the PLC device to read the device identification. According to the response of the PLC device to the List Identity command, the product name, version, serial number and other information can be obtained.

[0102] It should be noted that, in addition to the above-mentioned industrial Ethernet protocol, when the PLC device supports the SNMP / HTTP protocol, a connection is established with the PLC device based on the SNMP / HTTP protocol, and basic information of the PLC device is obtained.

[0103] The protection scope of the PLC device identification method described in the embodiment of the present invention is not limited to the execution order of the steps listed in this embodiment. All solutions implemented by adding, reducing or replacing steps in the prior art based on the principles of the present invention are included in the protection scope of the present invention.

[0104] An embodiment of the present invention also provides a PLC device identification system, which can implement the PLC device identification method described in the present invention. However, the implementation device of the PLC device identification system described in the present invention includes but is not limited to the structure of the PLC device identification system listed in this embodiment. All structural deformations and replacements of the prior art made according to the principles of the present invention are included in the protection scope of the present invention.

[0105] like Figure 3 As shown, in one embodiment, the PLC device identification system of the present invention includes a first acquisition module 31 , a second acquisition module 32 , an identification module 33 and a third acquisition module 34 .

[0106] The first acquisition module 31 is used to acquire the IP address and physical address of the PLC device in the network.

[0107] The second acquisition module 32 is connected to the first acquisition module 31 and is used to acquire the manufacturer type of the PLC device based on the physical address of the PLC device.

[0108] The identification module 33 is connected to the second acquisition module 32 and is used to identify the characteristic port of the PLC device based on the manufacturer type.

[0109] The third acquisition module 34 is connected to the identification module 33, and is used to acquire basic information of the PLC device based on the industrial Ethernet protocol message corresponding to the manufacturer type when the characteristic port is connectable.

[0110] The structures and principles of the first acquisition module 31 , the second acquisition module 32 , the identification module 33 and the third acquisition module 34 correspond one to one with the steps in the above-mentioned PLC device identification method, and thus will not be described in detail here.

[0111] It should be noted that it should be understood that the division of the various modules of the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software called by processing elements, or they can all be implemented in the form of hardware, or some modules can be implemented in the form of software called by processing elements, and some modules can be implemented in the form of hardware. For example: the x module can be a separately established processing element, or it can be integrated in a certain chip of the above device. In addition, the x module can also be stored in the memory of the above device in the form of program code, and called and executed by a certain processing element of the above device. The implementation of other modules is similar. These modules can be integrated together in whole or in part, or they can be implemented independently. The processing element described here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each module above can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software. The above modules may be one or more integrated circuits configured to implement the above methods, such as one or more application specific integrated circuits (ASIC), one or more microprocessors (DSP), one or more field programmable gate arrays (FPGA), etc. When a module is implemented in the form of a processing element scheduling program code, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call program code. These modules may be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0112] The storage medium of the present invention stores a computer program, which implements the above-mentioned PLC device identification method when executed by the processor. Preferably, the storage medium includes: ROM, RAM, disk, USB flash drive, memory card or optical disk and other media that can store program codes.

[0113] like Figure 4 As shown, in one embodiment, the PLC device identification terminal of the present invention includes: a processor 41 and a memory 42.

[0114] The memory 42 is used to store computer programs, and includes: ROM, RAM, disk, USB flash drive, memory card, optical disk, and other media that can store program codes.

[0115] The processor 41 is connected to the memory 42 and is used to execute the computer program stored in the memory so that the PLC device identification terminal executes the above-mentioned PLC device identification method.

[0116] Preferably, the processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0117] In summary, the PLC device identification method, system, storage medium and terminal of the present invention can realize accurate identification of PLC devices through industrial Ethernet protocol messages; they are compatible with multiple industrial Ethernet protocols and have strong practicality. Therefore, the present invention effectively overcomes various shortcomings in the prior art and has high industrial utilization value.

[0118] The above embodiments are merely illustrative of the principles and effects of the present invention, and are not intended to limit the present invention. Anyone familiar with the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by a person of ordinary skill in the art without departing from the spirit and technical concept disclosed by the present invention shall still be covered by the claims of the present invention.

Claims

1. A PLC device identification method, characterized in that: The method comprises the following steps: Get the IP address and physical address of the PLC device in the network; Acquire the manufacturer type of the PLC device based on the physical address of the PLC device; Identify a characteristic port of the PLC device based on the manufacturer type; When the characteristic port is connectable, basic information of the PLC device is obtained based on the industrial Ethernet protocol message corresponding to the manufacturer type.

2. The PLC device identification method according to claim 1, characterized in that: To obtain the IP address and physical address of the PLC device in the network, use any of the following methods: Scan the subnet of the network based on the nmap tool to obtain the IP address of the PLC device, and obtain the corresponding physical address based on the IP address; An ipNetToMedia table on the switch is obtained, a deduplication operation is performed on the ipNetToMedia table, and an IP address and a physical address of the PLC device are obtained based on the deduplication-free ipNetToMedia table.

3. The PLC device identification method according to claim 1, characterized in that: Acquiring the manufacturer type of the PLC device based on the physical address of the PLC device comprises the following steps: Construct an association table between the manufacturer type and physical address of PLC equipment; The manufacturer type corresponding to the physical address of the PLC device is obtained based on the association table.

4. The PLC device identification method according to claim 1, characterized in that: Identifying the characteristic port of the PLC device based on the manufacturer type comprises the following steps: Construct an association table between manufacturer type and feature port; A feature port corresponding to the manufacturer type is obtained based on the association table, and it is checked whether the feature port is open and connectable.

5. The PLC device identification method according to claim 1, characterized in that: Acquiring basic information of the PLC device based on the industrial Ethernet protocol message corresponding to the manufacturer type includes the following steps: Obtain the industrial Ethernet protocol corresponding to the manufacturer type; Establishing a connection with the PLC device based on the industrial Ethernet protocol; Basic information of the PLC device is obtained based on the connection.

6. The PLC device identification method according to claim 5, characterized in that: Acquiring basic information of the PLC device based on the connection includes the following steps: When the industrial Ethernet protocol is the S7 protocol, reading the device identification and CPU information of the PLC device; When the industrial Ethernet protocol is the FINS protocol, read the device model, device version and CPU running status of the PLC device; When the industrial Ethernet protocol is the MODBUS protocol, reading the device identification of the PLC device; When the industrial Ethernet protocol is the EtherNet / IP protocol, the device name, device version and device serial number are obtained according to the response information of the PLC device.

7. The PLC device identification method according to claim 1, characterized in that: It also includes establishing a connection with the PLC device based on the SNMP / HTTP protocol when the PLC device supports the SNMP / HTTP protocol, and acquiring basic information of the PLC device.

8. A PLC device identification system, characterized in that: The system includes a first acquisition module, a second acquisition module, an identification module and a third acquisition module; The first acquisition module is used to obtain the IP address and physical address of the PLC device in the network; The second acquisition module is used to acquire the manufacturer type of the PLC device based on the physical address of the PLC device; The identification module is used to identify the characteristic port of the PLC device based on the manufacturer type; The third acquisition module is used to acquire basic information of the PLC device based on the industrial Ethernet protocol message corresponding to the manufacturer type when the characteristic port is connectable.

9. A storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the PLC device identification method according to any one of claims 1 to 7 is implemented.

10. A PLC device identification terminal, characterized in that: include: Processor and memory; The memory is used to store computer programs; The processor is used to execute the computer program stored in the memory, so that the PLC device identification terminal executes the PLC device identification method according to any one of claims 1 to 7.

Images